Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Papago Translate

CRITICAL RISKRemoved from Chrome Web Store

Papago Translate

ID: enddgifdbfoefnelepppgaabobdfbcpe

Could be malicious

Supported Languages

🇺🇸English

🇰🇷Korean

Extension Info & Metadata

Status

Removed

Version

1.5.2

Size

0.23 MB

Rating

4.3/5

Reviews

623

Users

154,585

Type

Extension

Updated

Mar 9, 2023

Publisher Contextual Analysis

Trusted

Author: kkd927View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

154,585

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

View translations easily as you browse the web.

View AI translations easily as you browse the web. Highlight a section of text and click on Translate icon next to it to translate it to your language. Or, to translate the entire page you're visiting, click the translate icon on the browser toolbar. * This service works based Papago Open API, the NMT & SMT translation system, which is provided by Naver. * This service is operated by individuals in the hope of helping users surf the web without experiencing a language barrier, and this service is not intended for any profit. * You can check the Open APIs provided by Naver via https://developers.naver.com/main/

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+8.64%(+12,288 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 605 ratings+3 (0%)

Average Rating

Current: 4.33 / 5.0+0.10

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium2

Low3

Versions scanned

Showing 1 of 7 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.1 Code review	10

Extension Version	Code Review Findings
1.5.1	10

Files with findings

6 distinct paths — top paths by unique finding count:

src/js/analytics.js4
src/js/core.js2
src/js/content/content.js1
src/js/lib/require-cs.js1
src/js/manifest.json1
src/js/popup/app.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	high	src/js/analytics.js (line 568)	The beacon construction function J() builds a tracking pixel URL targeting wcs.naver.com including the document referrer (C), device fingerprint (R object), and hardwired Naver account ID '41bdc54d2e901c'. The n() fun…	1.5.1
2	Tracking	high	src/js/analytics.js (line 1)	The full Naver WCS (Web Comprehensive Statistics) analytics SDK is bundled and loaded on every web page the user visits via the content script dependency chain (content.js → analytics.js, matched against <all_urls> wi…	1.5.1
3	Tracking	high	src/js/popup/app.js (line 15)	Every time the extension popup is opened, an iframe is loaded from tab2.clickmon.co.kr (a Korean advertising network) with hardcoded ad placement IDs. The commented-out code immediately below reveals the original desi…	1.5.1
4	Unauthorized Data Collection	high	src/js/analytics.js (line 50)	The at() function assembles a comprehensive device fingerprint object (R) including OS platform, browser language, screen resolution, viewport dimensions, color depth, Java support, cookie enabled status, charset, and…	1.5.1
5	Unauthorized Data Collection	high	src/js/manifest.json (line 9)	The content script matches <all_urls> with all_frames:true, injecting JavaScript into every page and every iframe the user visits — including banking sites, email clients, and authenticated portals. The loaded content…	1.5.1
6	Obfuscation	medium	src/js/core.js (line 433)	The encodeData function applies base64 encoding followed by ROT13 cipher (function o) to the first 16 characters of outbound API payloads before transmitting them to the remote server. Applying ROT13 on top of base64 …	1.5.1
7	Unauthorized Data Collection	medium	src/js/core.js (line 235)	Selected text is POSTed to remote translation endpoints and cached locally. This is expected for a translation product, but from a security-review perspective it is still outbound transmission of page-derived content …	1.5.1
8	Code Injection	low	src/js/lib/require-cs.js (line 7)	This loader fetches JavaScript over XHR and executes it with `eval`. In this extension it appears intended to load packaged extension modules into the content-script environment, but the pattern is still risky because…	1.5.1
9	Tracking	low	src/js/analytics.js (line 573)	The bundled analytics library prepares requests to an external tracking endpoint, includes referrer data, and calls `at()` to populate browser/environment fields before transmission. I did not find any active, uncomme…	1.5.1
10	Unauthorized Data Collection	low	src/js/content/content.js (line 148)	The content script runs on all pages and captures arbitrary user-selected text from the current document. That behavior is central to translation, but it still means content from any site, including potentially sensit…	1.5.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	/webstore/detail/%ED%8C%8C%ED%8C%8C%EA%B3%A0-%EB%B2%88%EC%97%AD/enddgifdbfoefnelepppgaabobdfbcpe	https://chrome.google.com/webstore/detail/%ED%8C%8C%ED%8C%8C%EA%B3%A0-%EB%B2%88%EC%97%AD/enddgifdbfoefnelepppgaabobdfbcpe
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
papago-chrome.com	/favorites	https://papago-chrome.com/favorites
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
jqueryui.com	-	http://jqueryui.com
jqueryui.com	/themeroller/	http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActive=003eff&fcActive=ffffff&iconColorActive=ffffff&bgColorHighlight=fffa90&bgTextureHighlight=flat&borderColorHighlight=dad55e&fcHighlight=777620&iconColorHighlight=777620&bgColorError=fddfdf&bgTextureError=flat&borderColorError=f1a899&fcError=5f3f3f&iconColorError=cc0000&bgColorOverlay=aaaaaa&bgTextureOverlay=flat&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=666666&bgTextureShadow=flat&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=5px&offsetTopShadow=0px&offsetLeftShadow=0px&cornerRadiusShadow=8px

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

정말 감사합니다.영어공부에 매우 유익합니다.음성��복 기능�� 있�� 금상첨화 !! 모르는 단어 드래그��면 팝��으로 보이는 기��(음성,뜻) ��으�� 더 좋겠네요.그리고 원어민 음성이 남,녀 선택��수 있게 나오면 좋��습니다

wook·8 Mar 2023

구글 확장 프로그램 하고 비교해봤는데 구글보다 나음

김

김진명·8 Mar 2023

구글 확장 프로그램 �� 비교해��는데 구글보다 나��

김

김진명·8 Mar 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Papago Translate

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 7 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating